BowlerKit
Backend Architecture

Overview

8/18/2026

BowlerKit generates a Laravel admin-panel plus a shared /api/v1/app mobile contract for Account projects, while Guest projects can run local-first with Paywall and AdMob.

Overview

BowlerKit keeps one shared Expo or Flutter mobile codebase and asks for an app profile:

  • Account — includes landing-page, admin-panel, and api-backend; authentication and remote data are enabled.
  • Guest — local-first, no BowlerKit backend bundle, with Paywall and AdMob retained. The generated root contains docs/AI-GUEST-CLEANUP.md for optional runtime-only or deep cleanup.

Both profiles always include the mobile app.

Generated Folder Layout

With Backend

my-app/
├── mobile-app/          # Flutter app
├── landing-page/        # Marketing / landing page template
├── admin-panel/         # Laravel (Filament admin + auth issuance)
├── api-backend/         # Go mobile API server
├── api-collections/     # Postman collections (Account profile)
├── AGENTS.md            # AI project instructions
├── BOWLERKIT.md         # Generated project guide
├── .bowlerkit/project.json
└── docs/AI-GUEST-CLEANUP.md

Without Backend

my-app/
├── mobile-app/          # Flutter app
├── landing-page/        # Marketing / landing page template
├── AGENTS.md            # AI project instructions
├── BOWLERKIT.md         # Generated project guide
├── .bowlerkit/project.json
└── docs/AI-GUEST-CLEANUP.md

Backend Responsibilities

The backend is split into two services that share the same database.

Admin Panel (Laravel)

The Laravel admin-panel owns:

  • Auth issuance — Login, registration, Google OAuth, password reset, email verification. Issues Sanctum Personal Access Tokens.
  • Token management — Logout, session revocation. Laravel remains the session/token authority.
  • Admin dashboard — Filament-based panel for managing users, roles, permissions, content (FAQs, help center items), and system settings.
  • Content CRUD — Admin-facing create/update/delete for help center, FAQs, contacts, and operating hours.
  • Shared schema — Owns the auth/security schema including audit_logs.

API Backend (Go)

The Go api-backend is the protected resource API for Account projects. It shares the Laravel database and validates Sanctum tokens; it is not a standalone auth server.

For a first local run, Laravel can serve the complete mobile API origin. Put the Go service behind the production gateway only when /api/v1/app/* performance mode is needed.

  • Shared /api/v1/app/* routes — the same mobile resource routes exist in both Laravel compatibility mode and Go performance mode.
  • Go performance mode — low-latency runtime for the shared mobile contract.

Why Two Services?

  • Laravel handles what it does best: auth issuance, admin UI, email workflows, and content management.
  • Go can handle the shared mobile contract in performance mode with low latency, validating the same Sanctum tokens Laravel issues.
  • Both share the same MySQL/MariaDB database. Go will read the personal_access_tokens table directly using SHA-256 token hashing.

Routing Quick Reference

Canonical routing is prefix-based with Laravel on /api/v1/auth/*, /api/v1/uploads, and /api/v1/webhooks/revenuecat, while /api/v1/app/* can be routed to either Laravel compatibility mode or Go performance mode.

RouteOwnerNotes
POST /api/v1/auth/loginadmin-panelIssues Sanctum PAT
POST /api/v1/auth/registeradmin-panelIssues Sanctum PAT
POST /api/v1/auth/googleadmin-panelIssues Sanctum PAT
POST /api/v1/auth/appleadmin-panelIssues Sanctum PAT
POST /api/v1/auth/forgot-passwordadmin-panelLaravel mail
POST /api/v1/auth/reset-passwordadmin-panelLaravel mail
GET /api/v1/auth/email/verify/{id}/{hash}admin-panelEmail verification
POST /api/v1/auth/email/verification-notificationadmin-panelResend verification
POST /api/v1/auth/logoutadmin-panelToken revoke
PUT /api/v1/auth/update-passwordadmin-panelPassword update
GET /api/v1/auth/connected-accountsadmin-panelConnected-account list
POST /api/v1/auth/connected-accounts/googleadmin-panelLink Google account
POST /api/v1/auth/connected-accounts/appleadmin-panelLink Apple account
DELETE /api/v1/auth/connected-accounts/{provider}admin-panelUnlink provider
DELETE /api/v1/auth/security/sessions/{id}admin-panelSession revoke
DELETE /api/v1/auth/security/sessionsadmin-panelRevoke all sessions
DELETE /api/v1/auth/security/delete-accountadmin-panelAccount deletion
POST /api/v1/uploadsadmin-panelFile upload, returns URL
POST /api/v1/webhooks/revenuecatadmin-panelRevenueCat webhook
/api/v1/app/*shared mobile contractIdentical routes in Laravel compatibility mode or Go performance mode

Routing Recommendation

For production, use the shipped Caddy prefix routing as the canonical contract. The active prefixes are:

  • /api/v1/auth/* → admin-panel (Laravel, port 8000)
  • /api/v1/uploads → admin-panel (Laravel, port 8000)
  • /api/v1/webhooks/revenuecat → admin-panel (Laravel, port 8000)
  • /api/v1/app/* → admin-panel (Laravel compatibility mode, port 8000) or api-backend (Go performance mode, port 8080)
  • /admin → admin-panel (Laravel Filament)
  • / → landing-page

Start api-backend/compose.yaml with its production environment file on the shared web and shared networks before enabling /api/v1/app/* traffic.

Next Steps

Check out the Admin Panel and API Backend guides to set up your environment.

API Routes

Comprehensive list of REST API endpoints for the Mobile App Boilerplate.

Admin Panel (Laravel)

The Laravel admin-panel handles auth issuance, admin dashboard, and content management.

On this page

OverviewGenerated Folder LayoutWith BackendWithout BackendBackend ResponsibilitiesAdmin Panel (Laravel)API Backend (Go)Why Two Services?Routing Quick ReferenceRouting RecommendationNext Steps